m[.]fgxcaa[.]club

The domain m.fgxcaa.club is currently active and has been classified as a high‑risk generic phishing site. The domain was registered on May 14, 2026 through Dynadot Inc., and its DNS is served by Cloudflare nameservers melissa.ns.cloudflare.com and dimitris.ns.cloudflare.com. Traffic to the domain resolves to the Cloudflare edge address 104.21.14.220, which is geo‑located in Canada.

The site presents an HTTP 200 response and serves a TLS certificate issued by Google Trust Services under the WE1 name, indicating a valid SSL chain. The page title returned by the server is the Unicode string “Echo交易所”, which does not correspond to any known brand or service and suggests a placeholder or obfuscation technique. VirusTotal has flagged the domain in one of ninety‑five scanners, and three independent blocklists have already listed the domain, reflecting early detection by security communities.

Observations from public blocklists show that the domain is blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the phishing classification. The Gridinsoft trust score of 0 out of 100 further indicates a lack of reputation. No additional infrastructure such as extra IPs, sub‑domains, or associated malware hashes are publicly disclosed, leaving the full scope of the campaign uncertain.

Defenders should block DNS resolution for m.fgxcaa.club and any sub‑domains, enforce TLS inspection to capture the malicious payload, and monitor outbound traffic for connections to the 104.21.14.220 address. Incident response teams should also flag any credential submissions to URLs under this domain as compromised and advise affected users to reset credentials. Continuous monitoring of the listed blocklists will provide updates if the infrastructure expands.